fix(msteams): bound user token JSON reads

mmaps · mmaps · commit 96b784c37c80 · 2026-07-07T15:47:05.000Z
diff --git a/extensions/msteams/src/monitor-handler.sso.test.ts b/extensions/msteams/src/monitor-handler.sso.test.ts
@@ -141,6 +141,58 @@ describe("handleSigninTokenExchangeInvoke", () => {
     expect(stored).toBeNull();
   });
 
+  it("bounds successful User Token service JSON reads and cancels the stream", async () => {
+    const state = { canceled: false, enqueued: 0 };
+    const chunkBytes = 1024 * 1024;
+    const stream = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        if (state.enqueued >= 64) {
+          controller.close();
+          return;
+        }
+        state.enqueued += 1;
+        controller.enqueue(new Uint8Array(chunkBytes).fill(0x61));
+      },
+      cancel() {
+        state.canceled = true;
+      },
+    });
+    const jsonSpy = vi.spyOn(Response.prototype, "json").mockImplementation(async () => {
+      throw new Error("raw response.json() should not be used");
+    });
+    const fetchImpl: MSTeamsSsoFetch = vi.fn(async () => {
+      return new Response(stream, {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    });
+    const { sso, tokenStore } = createSsoDeps({ fetchImpl });
+
+    try {
+      const result = await handleSigninTokenExchangeInvoke({
+        value: { id: "flow-1", connectionName: "GraphConnection", token: "exchangeable-token" },
+        user: { userId: "aad-user-guid", channelId: "msteams" },
+        deps: sso,
+      });
+
+      expect(result.ok).toBe(false);
+      if (!result.ok) {
+        expect(result.code).toBe("unexpected_response");
+        expect(result.message).toMatch(/JSON response exceeds 16777216 bytes/);
+      }
+      expect(jsonSpy).not.toHaveBeenCalled();
+      expect(state.enqueued).toBeLessThan(32);
+      expect(state.canceled).toBe(true);
+      const stored = await tokenStore.get({
+        connectionName: "GraphConnection",
+        userId: "aad-user-guid",
+      });
+      expect(stored).toBeNull();
+    } finally {
+      jsonSpy.mockRestore();
+    }
+  });
+
   it("refuses to exchange without a user id", async () => {
     const { fetchImpl, calls } = createFakeFetch([]);
     const { sso } = createSsoDeps({ fetchImpl });
diff --git a/extensions/msteams/src/sso.ts b/extensions/msteams/src/sso.ts
@@ -24,6 +24,7 @@
  * that ack; these helpers encapsulate token exchange and persistence.
  */
 
+import { readProviderJsonResponse } from "openclaw/plugin-sdk/provider-http";
 import type { MSTeamsAccessTokenProvider } from "./attachments/types.js";
 import { readMSTeamsHttpErrorDetail } from "./http-error.js";
 import type { MSTeamsSsoTokenStore } from "./sso-token-store.js";
@@ -130,9 +131,15 @@ async function callUserTokenService(
   }
   let parsed: unknown;
   try {
-    parsed = await response.json();
-  } catch {
-    return { error: "invalid JSON from User Token service", status: response.status };
+    parsed = await readProviderJsonResponse<unknown>(
+      response,
+      "invalid JSON from User Token service",
+    );
+  } catch (error) {
+    return {
+      error: error instanceof Error ? error.message : "invalid JSON from User Token service",
+      status: response.status,
+    };
   }
   if (!parsed || typeof parsed !== "object") {
     return { error: "empty response from User Token service", status: response.status };
